The OP was discussing this in the context of the API changing.
It depends. Is the team responsible for BC1 changing fields on the
events a lot (exampla retunsa: last week the event was tracking the
order id and the skus + quantities that were ordered; this week they
added sales tax per item; next week they will add the discount
amount)? If so then BC2's team can't 'trust' what's coming out of
there and they should consider an ACL. But maybe the fields BC3 cares
about (e.g. the order's aggregate id and the total amount of the
order) have been stable, so they *don't* need an ACL.
In either case I think the last thing you want is a one size fits all solution.